Jens Haeusser Director, Strategy IT, UBC

1
The Future of Identity Management in Higher
EducationJA-SIG June 2007

• Jens HaeusserDirector, StrategyIT, UBC

2
Agenda

• Today Centralized Identity Management
• Overview, Best Practices, and Lessons Learned
• Identity 1.0
• Tomorrow Federated ID
• Shibboleth and eduroam
• Identity 1.5
• Whats Next Distributed / User Centric ID
• Open ID, Cardspace, and Claims
• Identity 2.0

3
What is Identity Management?

• Lifecycle maintenance of electronic accounts
• Provisioning
• Account creation
• Account updates
• Role maintenance
• Account removal
• Authentication Authorization
• Access Control

4
Why is it Important?

• Your identity is your most valuable possession.
  
• Protect it.
• And if anything goes wrong, use your powers!
  Elastigirl

Kim Camerons Identity Weblog
5
Todays Challenges

• Complex and fractured identity landscape
• Many systems of records
• Many applications
• Many passwords
• Many overlapping roles
• Make life easier for faculty, staff and students
• Enable access to resources
• Enforce privacy and security
• Create a sense of a unified University

6
Todays Solutions

• Consolidated directories
• Integrated and automated provisioning
• Multiple managed domain controllers
• Separation of Authentication and Authorization
• Role-based access control
• Virtual organizations
• Distributed and delegated administration
• Initial/reduced/single sign-on

7
A Provisioning Example
Authoritative Repositories
Student System
HR System
Domain Controllers
Applications/Services
8
Lessons Learned

• Its all about relationships
• Let people engage, cradle to grave
• Multiple, overlapping, ever changing
• Embrace multiple authoritative sources
• Authoritative for attributes, not people
• Account names should be ephemeral
• Users should be free to select and change
• Applications should record account ID, not name
• Dynamic rules, not static roles

9
Tomorrow Federation

• Todays solutions are institution centric
• Institution as walled garden
• Centralized Identity - Identity 1.0
• Tomorrows solutions move beyond the institution
• Broadcast identity from one institution to
  another
• Trust model controlled by institution, not user
• Federated Identity - Identity 1.5

10
What are Federations?

• Group of organizations sharing a set of agreed
  policies and rules for access to online resources
• enable members to establish trust and shared
  understanding of language or terminology
• provide a structure / legal framework that
  enables authentication and authorization
• Enables people to use their home credentials to
  connect to remote sites
• Without revealing their credentials
  (pseudonimity)
• Without releasing unnecessary private information

11
A Federation Example

• Authentication and Authorization Infrastructure

12
What is ?

• An open source project supporting
  inter-institutional sharing of web resources
  subject to access controls.
• Streamlines sharing secured online services
• Leverages campus identity and access management
  infrastructures
• sends information about users to resource site
• enables resource provider to make authorization
  decisions
• Ideal for lightweight web authentication
• digital libraries
• learning object repositories

13
How Does it Work?
2
1
3
4
14
Where is it Used?

• Information Providers
• Bodington
• EBSCO Publishing
• Elsevier ScienceDirect
• ExLibris - SFX
• JSTOR
• National Digital Science Library (NSDL)
• Project MUSE
• TurnItIn

• Products
• Blackboard
• Confluence
• EZProzy
• iTunesU
• Moodle
• Twiki
• Sakai
• Sympa
• WebCT

15
What is ?

• eduroam stands for Education Roaming
• Originally a European initiative
• Launched in 2003 to deal with the Roaming
  Scholar problem
• RADIUS-based infrastructure
• Uses 802.1X to allow inter-institutional roaming
• Allows users visiting other eduroam institutions
  to access WLAN using home credentials

16
How Does it Work?
International
.edu
ssid eduroam
National
.uk
.ca
3
2
4
5
1
Institutional
sfu
ubc
oxford
cambridge
user_at_ubc.ca
6
17
Where Does it Work?
18
Higher Education Federations

• Shibboleth
• InCommon (US)
• UK Access Management Federation
• eduroam
• JANET (UK)
• TERANA
• Policy Based
• CIMF (Canada)
• SWITCH (Switzerland)

19
What Comes Next?

• Move control from the institution to the
  individual
• Complex interactions with many institutions
• Greater control over identity data
• User chooses which attributes (claims) to
  release, and where to get those claims
• User Centric Identity - Identity 2.0

Of course I have a secret identity. I mean, do
you see me at the supermarket wearing... this?
Who wants to go shopping as Elastigirl, know what
I'm saying?"
20
What are Claims?

• An assertion, made by the user, of identity data
• Identifier (account name)
• Personal information (name, address, birthday)
• Group membership (over 21, University student)
• Multiple types
• Directly validated (password)
• User-asserted (self signed)
• Third party validated (trusted public key)

21
How Does it Work?
Optional
1. What claims?
2. Authenticate
3. Issue claims
4. Present claims
22
What is OpenID?

• Open source, distributed authentication system
• Simple and lightweight identity is a URL
• Fully decentralized and open platform
• I want to log into example.com
• I type my OpenID URL into the login form on
  example.com
• example.com redirects me (via my web-browser) to
  myopenid.com
• I tell myopenid.com whether or not I trust
  example.com with my identity
• I am redirected back to example.com and am
  automatically logged in

23
What is CardSpace?

• Windows client software- part of Microsofts
  Identity Metasystem
• Stores Identity Cards
• Bundles of claims
• Managed or self-issued cards
• Presents user with choice of valid cards
• Token Agnostic
• Can use SAML, Shibboleth, OpenID, WS-,

24
The Coming Convergence

• Still early days, and rapid development, but
• Active, open conversation between developers,
  creating the Internet Identity Layer
• Open Source Infocard clients and servers emerging
• Microsoft sponsored Shibboleth-Cardspace
  integration
• CAS 3.1 supports OpenID and SAML

25
Conclusion

• Identity practice undergoing dramatic changes
• Users will expect to engage with us in new ways
• Bring identity information when they join
• Gradual migration to claim based access
• Prepare by continuing to strengthen and
  consolidate internal Identity Management
• Target low hanging fruit for Federation
• Keep abreast of user-centric identity management

26
Questions?

• jens.haeusser_at_ubc.ca

27
Additional Resources

• OpenID
• Higgins Open Source Identity Project
• CardSpace Wikipedia Article
• Burton Document The Information Card Landscape
  (CardSpace and Higgins)
• eduroam
• Shibboleth
• CIMF Shibboleth Pilot
• Phil Windleys Technometria
• Phil Windleys book Digital Identity sample
  chapter
• Kim Camerons Blog
• Kim Camerons Laws of Identity
• Dick Hardts Blog

28
(No Transcript)
29
(No Transcript)
30
(No Transcript)
31
(No Transcript)
32
(No Transcript)
33
(No Transcript)
34
(No Transcript)